amplify/system

Five active contributors and 21 recent commits show the project is being maintained. The package includes release notes and a changelog, but its broad runtime dependency set and absent security policy add integration and oversight costs.

Latest 1.5.4

Packagist

72%

Total Score

Maintainer Stability

100

Dependencies

Maturity

Supply Chain

Health Score Breakdown

Dependency profile

The package declares 37 runtime dependencies, including many internal modules and framework integrations. That broad dependency surface increases upgrade and compatibility burden for consumers.

License

The manifest declares GPL-3.0-or-later, while the artifact also contains an Apache-2.0 font license file. The release is licensed, but the differing detected license warrants checking which files each license covers.

Repo tooling

Composer is used for builds, but no security-scanning tools are configured. The missing scanning coverage is a transparency gap, though it does not show abandonment.

Security policy

The repository has no security policy. For a system module with many runtime integrations, the absence of a documented vulnerability-reporting path lowers operational transparency.

Workflow audit

The sole workflow has a high-confidence template-injection finding, but it has no untrusted checkout or script-injection count and no broad write permissions. The finding is therefore a workflow-hygiene concern rather than a standalone severe health risk.